We summarise the modes of operation covered in this chapter.

\noindent{\bf Electronic Codebook Mode.}
For a fixed key $K$, the output ciphertext is given by
$C_j = E_K(M_j)$ with output $C_1 C_2 \dots$.

\noindent{\bf Ciphertext Block Chaining Mode.}
For input key $K$, and initialization vector $IV = C_0$, the output
ciphertext is given by $C_j = E_K(C_{j-1} \oplus M_j)$, with
output $C_0 C_1 C_2 \ldots$.

\noindent{\bf Ciphertext Feedback Mode.}
Given plaintext $M_1M_2\dots$ in $r$-bit blocks, a key $K$,
an $n$-bit cipher $E_K$, and an $n$-bit initialization vector
$IV = I_1$, the ciphertext is computed as:
$$
\begin{array}{l}
C_j = M_j \oplus L_r(E_K(I_j))\\
I_{j+1} = R_{n-r}(I_j)\,||\,C_j
\end{array}
$$
where $R_{n-r}$ and $L_r$ are the operators which take the
right-most $n-r$ bits and the left-most $r$ bits, respectively,
and $||$ is concatenation.

\noindent
{\bf Output Feedback Mode.}
Given plaintext $M_1M_2\dots$ in $r$-bit blocks, a key $K$,
an $n$-bit cipher $E_K$, and an $n$-bit initialization vector
$IV = I_0$, the ciphertext is computed as:
\begin{eqnarray*}
&& I_j = E_K(I_{j-1})\\
&& C_j = M_j \oplus L_r(I_j),
\end{eqnarray*}
where $L_r$ is the operator which takes the left-most $r$ bits.

\begin{exercise}
\label{ex:block_ciphers:disadvantages_of_mode}
What mode of operation has been used in the assignment and in class
up to this point, and why?  What are the security disadvantages of
this mode of operation?
\end{exercise}

\begin{exercise}
\label{ex:block_ciphers:encipher_with_ECB_CBC_CFB}
Let $E_K$ be the 4-bit cipher defined by:
$$
E_K(M) = (K \oplus M)
\left(\begin{array}{cccc}
1&0&0&1\\ 0&1&1&0 \\ 1&0&1&0 \\ 0&1&0&1
\end{array}\right) =
(X_1+X_3,X_2+X_4,X_2+X_3,X_1+X_4)
$$
where $X = K\oplus M = (X_1,X_2,X_3,X_4)$. Encipher the message $M$
given by
$$
{\tt 11010110111001110010010001001000},
$$
using the key $K = 1011$, in (i) ECB mode, in (ii) CBC mode
with initialization vector $1001$, and in (iii) CFB mode
with initialization vector $1001$ and $r = 1$.
\end{exercise}

\begin{exercise}
\label{ex:block_ciphers:steps_required_error_recovery}
How many steps are required for error recovery from a ciphertext
transmission error in ECB and CBC modes?
\end{exercise}

\begin{exercise}
\label{ex:block_ciphers:steps_in_CFB_to_recover_error}
If $n = 64$ and $r = 8$, how many steps in CFB mode does it take to
recover from an error in a ciphertext block?  What about in OFB mode?
\end{exercise}
